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DETAILED ACTION 

1 . This office action is in response to Applicant's amendment filed on May 9, 2007. 
Claims 1, 7-8, 14, 17, 20-21, 27-28, 34, 37, 41, 47-48, 54, 57 and 60 have been 
amended. New claims 61-64 have been added. Claims 1-64 are pending. 

Claim Rejections - 35 USC §112 

2. In view of the amendment filed May 9, 2007, the Examiner withdraws the 
rejection of claims 8-14, 28-34 and 48-54 under 35 U.S.C. 112. 

Claim Rejections - 35 USC § 101 

3. In view of the amendment filed May 9, 2007, the Examiner withdraws the 
rejection of claims 41-60 under 35 U.S.C. 101. 

Response to Arguments 

4. Applicant's arguments filed May 9, 2007 have been considered but are moot in 
view of the new ground(s) of rejection. 

Claim Rejections - 35 USC § 103 

5. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 

obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed 
or described as set forth in section 102 of this title, if the differences between the 
subject matter sought to be patented and the prior art are such that the subject 
matter as a whole would have been obvious at the time the invention was made 
to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was 
made. 
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6. Claims 1-63 are rejected under 35 U.S.C. 103(a) as being unpatentable over Tso 
et al. (hereinafter Tso) US Patent 6,088,803 in view of Fielding et al. "Hypertext Transfer 
Protocol - HTTP/1.1", RFC, June 1999, (hereinafter Fielding). 
As per claims 1, 21 and 41 

Tso teaches a method of scanning a requested file for a computer malware 
comprising the steps of: 

receiving a request to transfer a file from computer malware scanning software; 
(col. 2, lines 16-67) 

receiving a request from the computer malware scanning software for data 
comprising a randomly accessed portion of the requested file; (col. 3, lines 10-54; col. 5, 
lines 1-43) and 

transferring the requested portion of the file and supplying the requested data to 
the computer malware scanning software to fulfill the request for data comprising a 
portion of the requested file. (col. 3, lines 10-54; col. 5, lines 1-43) 

Tso does not explicitly disclose wherein the randomly accessed portion of the file 
is requested utilizing a byte range technique. Fielding in analogous art, however 
discloses wherein the randomly accessed portion of the file is requested utilizing a byte 
range technique, (pages 82-83, Section 14.27: If-Range; Pages 85-86, Section 14.35 
Range) Therefore it would have been obvious to one ordinary skill in the art at the time 
the invention was made to modify the device disclosed by Tso with Fielding in order to 
request one or more sub-ranges of a file, instead of the entire file, using the range 
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request header to have an up-to-date copy of the entire file, (page 82, 14.27 If-Range; 
Fielding) 

As per claims 2, 22 and 42: 

The combination of Tso and Fielding teaches all the subject matter as discussed 
above. In addition, Tso further discloses a method wherein the request to transfer the 
file from the computer malware scanning software comprises a request to transfer the 
file from an external system, (col. 2, lines 22-25) 
As per claims 3-4, 23-24 and 43-44: 

The combination of teaches all the subject matter as discussed above. In 
addition, Tso further discloses a method wherein the external system is 
communicatively connected via a network, (figure 1) 
As per claims 5, 18, 25, 38, 45 and 58: 

The combination of Tso and Fielding teaches all the subject matter as discussed 
above. In addition, Fielding further discloses a method wherein the step of transferring 
the requested portion of the file comprises the step of: initiating a session with the 
external system to obtain the requested portion of the file, (pages 82-83, Section 14.27: 
If-Range; Pages 85-86, Section 14.35 Range) 
As per claims 6, 19, 26, 39, 46 and 59: 

The combination of Tso and Fielding teaches all the subject matter as discussed 
above. In addition, Fielding further discloses a method wherein the session is a 
hypertext transfer protocol session, (pages 82-83, Section 14.27: If-Range; Pages 85- 
86, Section 14.35 Range) 
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As per claims 15, 35 and 55: 

The combination of Tso and Fielding teaches all the subject matter as discussed 
above. In addition, Tso further discloses a method comprising the step of: performing 
the steps of claim 1 in response to a request from a user system for the file. (col. 2, lines 
16-67) 

As per claims 16, 36 and 56: 

The combination of Tso and Fielding teaches all the subject matter as discussed 
above. In addition, Tso further discloses a method comprising the steps of: scanning at 
the computer malware scanning software the data comprising a portion of the requested 
file to determine if the file includes a computer malware; (col. 3, lines 10-54) and 
delivering the file to the user system in response to determining that the file does not 
include a computer malware. (col. 3, lines 38-65) 
As per claims 17, 37 and 57: 

The combination of Tso and Fielding teaches all the subject matter as discussed 
above. In addition, Fielding further discloses a method wherein the step of delivering the 
file to the user system comprises the steps of: determining whether the entire file has 
been transferred; (pages 82-83, Section 14.27: If-Range; Pages 85-86, Section 14.35 
Range) starting delivery of the file to the user system even if the entire file has not been 
transferred; (pages 82-83, Section 14.27: If-Range; Pages 85-86, Section 14.35 Range) 
and transferring those portions of the file that have not been transferred and delivering 
those portions of the file once they have been transferred, (pages 82-83, Section 14.27: 
If-Range; Pages 85-86, Section 14.35 Range) 
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As per claims 7, 20, 27, 40, 47 and 60: 

The combination of Tso and Fielding teaches all the subject matter as discussed 
above. In addition, Fielding further discloses wherein the hypertext transfer protocol 
session uses the byte range technique, (pages 82-83, Section 14.27: If-Range; Pages 
85-86, Section 14.35 Range) 
As per claims 8, 28 and 48: 

The combination of Tso and Fielding teaches all the subject matter as discussed 
above. In addition, Fielding further discloses a method comprising the steps of: 
determining that the requested portion of the requested file cannot be transferred; 
(pages 82-83, Section 14.27: If-Range; Pages 85-86, Section 14.35 Range) and 
transferring an entirety of the requested file and supplying the requested data to the 
computer malware scanning software to fulfill the request for data comprising a portion 
of the requested file, (pages 82-83, Section 14.27: If-Range; Pages 85-86, Section 
14.35 Range) 

As per claims 9, 29 and 49: 

The combination of Tso and Fielding teaches all the subject matter as discussed 
above. In addition, Fielding further discloses a method wherein the requested portion of 
the requested file cannot be transferred because the requested portion of the requested 
file cannot be randomly accessed, (pages 82-83, Section 14.27: If-Range; Pages 85-86, 
Section 14.35 Range) 
As per claims 10, 30 and 50: 
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The combination of Tso and Fielding teaches all the subject matter as discussed 
above. In addition, Fielding further discloses a method wherein an indication that the 
requested portion of the requested file cannot be randomly accessed comprises an 
error indication or a transfer of the entire requested file, (pages 82-83, Section 14.27: If- 
Range; Pages 85-86, Section 14.35 Range) 
As per claims 11,31 and 51 : 

The combination of Tso and Fielding teaches all the subject matter as discussed 
above. In addition, Fielding further discloses a method comprising the steps of: tracking 
information associated with each transfer of a requested portion of the file; and 
determining that information associated with the file has changed, (pages 82-83, 
Section 14.27: If-Range; Pages 85-86, Section 14.35 Range) 
As per claims 12, 32 and 52 

The combination of Tso and Fielding teaches all the subject matter as discussed 
above. In addition, Fielding further discloses a method wherein the information 
associated with the file comprises hypertext transfer protocol entity tags or last modified 
timestamp information, (pages 82-83, Section 14.27: If-Range; Pages 85-86, Section 
14.35 Range) 

As per claims 13, 33 and 53: 

The combination of Tso and Fielding teaches all the subject matter as discussed 
above. In addition, Tso further teaches a method comprising the step of: restarting the 
requests from the computer malware scanning software for data. (col. 3, lines 10-54) 
As per claims 14, 34 and 54: 
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The combination of Tso and Fielding teaches all the subject matter as discussed 
above. In addition, Fielding further discloses a method comprising the step of: 
transferring an entirety of the requested file, (pages 82-83, Section 14.27: If-Range; 
Pages 85-86, Section 14.35 Range) 
As per claim 61: 

The combination of Tso and Fielding teaches all the subject matter as discussed 
above. In addition, Fielding further discloses a method wherein the byte range 
technique turns a serial download mechanism into a random access file mechanism, 
(pages 82-83, Section 14.27: If-Range; Pages 85-86, Section 14.35 Range) 
As per claim 62: 

The combination of Tso and Fielding teaches all the subject matter as discussed 
above. In addition, Tso further teaches a method wherein the data associated with the 
request from the computer malware scanning software comprises a plurality of selected 
randomly accessed portions of the requested file. (col. 3, lines 10-54; col. 5, lines 1-43) 
As per claim 64: 

The combination of Tso and Fielding teaches all the subject matter as discussed 
above. In addition, Tso further teaches a method wherein the plurality of selected 
randomly accessed portions of the requested file are read in a random order, (col. 3, 
lines 10-54; col. 5, lines 1-43) 

7. Claims 64 is rejected under 35 U.S.C. 103(a) as being unpatentable over Tso et 
al. (hereinafter Tso) US Patent 6,088,803 in view of Fielding et al. "Hypertext Transfer 
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Protocol - HTTP/1 .1" (hereinafter Fielding) and further in view of Guthrie U.S. Patent 
Number 6,266,681. 
As per claim 64: 

The combination of Tso and Fielding teaches all the subject matter as discussed 
above. Both references do not explicitly disclose a method wherein a system call 
handler intercepts system level calls made by the computer malware scanning software 
and simulates system level function calls utilized by the computer malware scanning 
software to determine whether the file includes the computer malware. Guthrie in 
analogous art, however, discloses a system call handler intercepts system level calls 
made by the computer malware scanning software and simulates system level function 
calls utilized by the computer malware scanning software to determine whether the file 
includes the computer malware. (col. 2, lines 22-64; col. 3, lines 31-42) Therefore it 
would have been obvious to one ordinary skill in the art at the time the invention was 
made to modify the device disclosed by Tso and Fielding with Guthrie in order to 
provide additional security by intercepting http messages enabling browser with 
additional functionality without modifying the browser, (page 82, 14.27 If-Range; 
Fielding) 

Conclusion 

8. Applicant's amendment necessitated the new ground(s) of rejection presented in 
this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP 
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§ 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 
CFR 1.136(a). 

A shortened statutory period for reply to this final action is set to expire THREE 
MONTHS from the mailing date of this action. In the event a first reply is filed within 
TWO MONTHS of the mailing date of this final action and the advisory action is not 
mailed until after the end of the THREE-MONTH shortened statutory period, then the 
shortened statutory period will expire on the date the advisory action is mailed, and any 
extension fee pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of 
the advisory action. In no event, however, will the statutory period for reply expire later 
than SIX MONTHS from the date of this final action. 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Shewaye Gelagay whose telephone number is 571-272- 
4219. The examiner can normally be reached on 8:00 am to 5:30 pm. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Emmanuel Moise can be reached on 571-272-3865. The fax phone number 
for the organization where this application or proceeding is assigned is 571-273-8300. 
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Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a 
USPTO Customer Service Representative or access to the automated information 
system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 
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